Conditional redirection to discovery service

[Cantor, Scott]

On 3/2/21, 9:18 AM, "users on behalf of Guillaume Rousse" <users-bounces at shibboleth.net on behalf of guillaume.rousse at renater.fr> wrote:

>    And handling the issue at SP level would protect our network, as most of 
>    these SP are actually external ones. As an NREN, we allow our community 
>    to use our discovery service, to avoid deploying their own one, which 
>    often has this kind of undesirable results.

I don't see how it makes sense to do something in 100 places when you have a natural spot to do it in one place. Particularly when the user agent testing would be hard to make consistent across all those places.

>    Hence my attempt to provide SP admins simple instructions to keep their 
>    own problematic users at home, intead of sending them to us.

You could give them a script to deploy as a "DS" to run interference first before redirecting them on to you. Same effect without changing the code.

-- Scott